kernel BUG in vma_replace_policy

kernel BUG in vma_replace_policy

Status: upstream: reported C repro on 2023/09/06 01:03
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+b591856e0f0139f83023@syzkaller.appspotmail.com
Fix commit: mm: lock VMAs skipped by a failed queue_pages_range()
Patched on: [ci-upstream-linux-next-kasan-gce-root], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 1015d, last: 1002d

Cause bisection: introduced by (bisect log) :
commit 49b0638502da097c15d46cd4e871dbaa022caf7c
Author: Suren Baghdasaryan <surenb@google.com>
Date: Fri Aug 4 15:27:19 2023 +0000

mm: enable page walking API to lock vmas during the walk

Crash: kernel BUG in vma_replace_policy (log)
Repro: C syz .config

▶ ▼ ✨ AI Jobs (4)

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision	Error
8b6be994-28f7-406e-882b-6714e6eb09ae	assessment-security		💥	kernel BUG in vma_replace_policy	2026/06/09 23:08	2026/06/09 23:08	2026/06/09 23:30	c36c07f6c1f2230a36374cbd22235f635e8f9284	failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/8e98d3467a2b36f93ae1dc107aa0df397b7e4390" "-s" "bzImage" "compile_commands.json"]: exit status 2 Root cause: include/linux/thread_info.h:244:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small * * Restart config... * * * General architecture-dependent options * Kprobes (KPROBES) [N/y/?] n Optimize very unlikely/likely branches (JUMP_LABEL) [Y/n/?] y Static key selftest (STATIC_KEYS_SELFTEST) [N/y/?] n Static call selftest (STATIC_CALL_SELFTEST) [N/y/?] n Enable seccomp to safely execute untrusted bytecode (SECCOMP) [Y/n/?] y Show seccomp filter cache status in /proc/pid/seccomp_cache (SECCOMP_CACHE_DEBUG) [N/y/?] n Link Time Optimization (LTO) > 1. None (LTO_NONE) choice[1]: 1 Use Clang's Control Flow Integrity (CFI) (CFI_CLANG) [N/y/?] (NEW) Error in reading or end of file. Number of bits to use for ASLR of mmap base address (ARCH_MMAP_RND_BITS) [28] 28 Number of bits to use for ASLR of mmap base address for compatible applications (ARCH_MMAP_RND_COMPAT_BITS) [8] 8 Provide system calls for 32-bit time_t (COMPAT_32BIT_TIME) [Y/n/?] y Use a virtually-mapped stack (VMAP_STACK) [Y/n/?] y Support for randomizing kernel stack offset on syscall entry (RANDOMIZE_KSTACK_OFFSET) [Y/n/?] y Default state of kernel stack offset randomization (RANDOMIZE_KSTACK_OFFSET_DEFAULT) [N/y/?] n Locking event counts collection (LOCK_EVENT_COUNTS) [N/y/?] n * * Kernel hardening options * Randomize layout of sensitive kernel structures > 1. Disable structure layout randomization (RANDSTRUCT_NONE) 2. Fully randomize structure layout (RANDSTRUCT_FULL) (NEW) choice[1-2?]: Error in reading or end of file. * * Compile-time checks and compiler options * Debug information 1. Disable debug information (DEBUG_INFO_NONE) 2. Rely on the toolchain's implicit default DWARF version (DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT) > 3. Generate DWARF Version 4 debuginfo (DEBUG_INFO_DWARF4) 4. Generate DWARF Version 5 debuginfo (DEBUG_INFO_DWARF5) choice[1-4?]: 3 Reduce debugging information (DEBUG_INFO_REDUCED) [N/y/?] n Compressed Debug information > 1. Don't compress debug information (DEBUG_INFO_COMPRESSED_NONE) 2. Compress debugging information with zlib (DEBUG_INFO_COMPRESSED_ZLIB) 3. Compress debugging information with zstd (DEBUG_INFO_COMPRESSED_ZSTD) (NEW) choice[1-3?]: Error in reading or end of file. Produce split debuginfo in .dwo files (DEBUG_INFO_SPLIT) [N/y/?] n Generate BTF typeinfo (DEBUG_INFO_BTF) [N/y/?] n Provide GDB scripts for kernel debugging (GDB_SCRIPTS) [N/y/?] n Warn for stack frames larger than (FRAME_WARN) [2048] 2048 Strip assembler-generated symbols during link (STRIP_ASM_SYMS) [N/y/?] n Install uapi headers to usr/include (HEADERS_INSTALL) [N/y/?] n Make section mismatch errors non-fatal (SECTION_MISMATCH_WARN_ONLY) [Y/n/?] y Force all function address 64B aligned (DEBUG_FORCE_FUNCTION_ALIGN_64B) [N/y/?] n Generate vmlinux.map file when linking (VMLINUX_MAP) [N/y/?] n Force weak per-cpu definitions (DEBUG_FORCE_WEAK_PER_CPU) [N/y/?] n In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/arch/x86/kernel/asm-offsets.c:14: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/suspend.h:5: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/swap.h:9: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/memcontrol.h:20: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/mm.h:2168: /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 \| return vmstat_text[NR_VM_ZONE_STAT_ITEMS + \|
2bbac678-39aa-49ca-83ba-a45c901c937a	assessment-security		💥	kernel BUG in vma_replace_policy	2026/06/04 00:39	2026/06/04 00:39	2026/06/04 00:52	62fe15281f5011cd203d8845b8767b10e7443aa5	failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/8e98d3467a2b36f93ae1dc107aa0df397b7e4390" "-s" "bzImage" "compile_commands.json"]: exit status 2 Root cause: include/linux/thread_info.h:244:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small * * Restart config... * * * General architecture-dependent options * Kprobes (KPROBES) [N/y/?] n Optimize very unlikely/likely branches (JUMP_LABEL) [Y/n/?] y Static key selftest (STATIC_KEYS_SELFTEST) [N/y/?] n Static call selftest (STATIC_CALL_SELFTEST) [N/y/?] n Enable seccomp to safely execute untrusted bytecode (SECCOMP) [Y/n/?] y Show seccomp filter cache status in /proc/pid/seccomp_cache (SECCOMP_CACHE_DEBUG) [N/y/?] n Link Time Optimization (LTO) > 1. None (LTO_NONE) choice[1]: 1 Use Clang's Control Flow Integrity (CFI) (CFI_CLANG) [N/y/?] (NEW) Error in reading or end of file. Number of bits to use for ASLR of mmap base address (ARCH_MMAP_RND_BITS) [28] 28 Number of bits to use for ASLR of mmap base address for compatible applications (ARCH_MMAP_RND_COMPAT_BITS) [8] 8 Provide system calls for 32-bit time_t (COMPAT_32BIT_TIME) [Y/n/?] y Use a virtually-mapped stack (VMAP_STACK) [Y/n/?] y Support for randomizing kernel stack offset on syscall entry (RANDOMIZE_KSTACK_OFFSET) [Y/n/?] y Default state of kernel stack offset randomization (RANDOMIZE_KSTACK_OFFSET_DEFAULT) [N/y/?] n Locking event counts collection (LOCK_EVENT_COUNTS) [N/y/?] n * * Kernel hardening options * Randomize layout of sensitive kernel structures > 1. Disable structure layout randomization (RANDSTRUCT_NONE) 2. Fully randomize structure layout (RANDSTRUCT_FULL) (NEW) choice[1-2?]: Error in reading or end of file. * * Compile-time checks and compiler options * Debug information 1. Disable debug information (DEBUG_INFO_NONE) 2. Rely on the toolchain's implicit default DWARF version (DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT) > 3. Generate DWARF Version 4 debuginfo (DEBUG_INFO_DWARF4) 4. Generate DWARF Version 5 debuginfo (DEBUG_INFO_DWARF5) choice[1-4?]: 3 Reduce debugging information (DEBUG_INFO_REDUCED) [N/y/?] n Compressed Debug information > 1. Don't compress debug information (DEBUG_INFO_COMPRESSED_NONE) 2. Compress debugging information with zlib (DEBUG_INFO_COMPRESSED_ZLIB) 3. Compress debugging information with zstd (DEBUG_INFO_COMPRESSED_ZSTD) (NEW) choice[1-3?]: Error in reading or end of file. Produce split debuginfo in .dwo files (DEBUG_INFO_SPLIT) [N/y/?] n Generate BTF typeinfo (DEBUG_INFO_BTF) [N/y/?] n Provide GDB scripts for kernel debugging (GDB_SCRIPTS) [N/y/?] n Warn for stack frames larger than (FRAME_WARN) [2048] 2048 Strip assembler-generated symbols during link (STRIP_ASM_SYMS) [N/y/?] n Install uapi headers to usr/include (HEADERS_INSTALL) [N/y/?] n Make section mismatch errors non-fatal (SECTION_MISMATCH_WARN_ONLY) [Y/n/?] y Force all function address 64B aligned (DEBUG_FORCE_FUNCTION_ALIGN_64B) [N/y/?] n Generate vmlinux.map file when linking (VMLINUX_MAP) [N/y/?] n Force weak per-cpu definitions (DEBUG_FORCE_WEAK_PER_CPU) [N/y/?] n In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/arch/x86/kernel/asm-offsets.c:14: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/suspend.h:5: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/swap.h:9: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/memcontrol.h:20: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/mm.h:2168: /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 \| return vmstat_text[NR_VM_ZONE_STAT_ITEMS + \|
79ac9994-aef1-4301-9477-b1a65f83d192	assessment-security		💥	kernel BUG in vma_replace_policy	2026/06/01 06:14	2026/06/01 06:14	2026/06/01 06:26	6b4a844333e83556da95d61d7f207e7ef5cd4bc6	failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/8e98d3467a2b36f93ae1dc107aa0df397b7e4390" "-s" "bzImage" "compile_commands.json"]: exit status 2 Root cause: include/linux/thread_info.h:244:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small * * Restart config... * * * General architecture-dependent options * Kprobes (KPROBES) [N/y/?] n Optimize very unlikely/likely branches (JUMP_LABEL) [Y/n/?] y Static key selftest (STATIC_KEYS_SELFTEST) [N/y/?] n Static call selftest (STATIC_CALL_SELFTEST) [N/y/?] n Enable seccomp to safely execute untrusted bytecode (SECCOMP) [Y/n/?] y Show seccomp filter cache status in /proc/pid/seccomp_cache (SECCOMP_CACHE_DEBUG) [N/y/?] n Link Time Optimization (LTO) > 1. None (LTO_NONE) choice[1]: 1 Use Clang's Control Flow Integrity (CFI) (CFI_CLANG) [N/y/?] (NEW) Error in reading or end of file. Number of bits to use for ASLR of mmap base address (ARCH_MMAP_RND_BITS) [28] 28 Number of bits to use for ASLR of mmap base address for compatible applications (ARCH_MMAP_RND_COMPAT_BITS) [8] 8 Provide system calls for 32-bit time_t (COMPAT_32BIT_TIME) [Y/n/?] y Use a virtually-mapped stack (VMAP_STACK) [Y/n/?] y Support for randomizing kernel stack offset on syscall entry (RANDOMIZE_KSTACK_OFFSET) [Y/n/?] y Default state of kernel stack offset randomization (RANDOMIZE_KSTACK_OFFSET_DEFAULT) [N/y/?] n Locking event counts collection (LOCK_EVENT_COUNTS) [N/y/?] n * * Kernel hardening options * Randomize layout of sensitive kernel structures > 1. Disable structure layout randomization (RANDSTRUCT_NONE) 2. Fully randomize structure layout (RANDSTRUCT_FULL) (NEW) choice[1-2?]: Error in reading or end of file. * * Compile-time checks and compiler options * Debug information 1. Disable debug information (DEBUG_INFO_NONE) 2. Rely on the toolchain's implicit default DWARF version (DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT) > 3. Generate DWARF Version 4 debuginfo (DEBUG_INFO_DWARF4) 4. Generate DWARF Version 5 debuginfo (DEBUG_INFO_DWARF5) choice[1-4?]: 3 Reduce debugging information (DEBUG_INFO_REDUCED) [N/y/?] n Compressed Debug information > 1. Don't compress debug information (DEBUG_INFO_COMPRESSED_NONE) 2. Compress debugging information with zlib (DEBUG_INFO_COMPRESSED_ZLIB) 3. Compress debugging information with zstd (DEBUG_INFO_COMPRESSED_ZSTD) (NEW) choice[1-3?]: Error in reading or end of file. Produce split debuginfo in .dwo files (DEBUG_INFO_SPLIT) [N/y/?] n Generate BTF typeinfo (DEBUG_INFO_BTF) [N/y/?] n Provide GDB scripts for kernel debugging (GDB_SCRIPTS) [N/y/?] n Warn for stack frames larger than (FRAME_WARN) [2048] 2048 Strip assembler-generated symbols during link (STRIP_ASM_SYMS) [N/y/?] n Install uapi headers to usr/include (HEADERS_INSTALL) [N/y/?] n Make section mismatch errors non-fatal (SECTION_MISMATCH_WARN_ONLY) [Y/n/?] y Force all function address 64B aligned (DEBUG_FORCE_FUNCTION_ALIGN_64B) [N/y/?] n Generate vmlinux.map file when linking (VMLINUX_MAP) [N/y/?] n Force weak per-cpu definitions (DEBUG_FORCE_WEAK_PER_CPU) [N/y/?] n In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/arch/x86/kernel/asm-offsets.c:14: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/suspend.h:5: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/swap.h:9: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/memcontrol.h:20: In file included from /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/mm.h:2168: /app/workdir/cache/src/168a9723d1b6f54e30df94216b1077a3b3e2310f/include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 \| return vmstat_text[NR_VM_ZONE_STAT_ITEMS + \|
c947aa7a-addb-4345-95e1-c8ca6b8522d7	assessment-security		💥	kernel BUG in vma_replace_policy	2026/05/15 10:27	2026/05/15 10:27	2026/05/15 10:28	9cd3beaadf14b3a22d15fd97a0bf081ee41ebe01	failed to run ["git" "pull" "origin" "HEAD" "--depth=1" "--allow-unrelated-histories"]: exit status 128 From /app/workdir/repo/linux * branch HEAD -> FETCH_HEAD error: unable to write file Documentation/devicetree/bindings/soc/mediatek/mediatek,ccorr.yaml error: unable to write file Documentation/devicetree/bindings/soc/mediatek/mediatek,mt7986-wo-ccif.yaml error: unable to write file Documentation/devicetree/bindings/soc/mediatek/mediatek,mutex.yaml error: unable to write file Documentation/devicetree/bindings/soc/mediatek/mediatek,pwrap.yaml error: unable to write file Documentation/devicetree/bindings/soc/mediatek/mediatek,wdma.yaml error: unable to write file Documentation/devicetree/bindings/soc/mediatek/mtk-svs.yaml error: unable to write file Documentation/devicetree/bindings/soc/mediatek/scpsys.txt fatal: cannot create directory at 'Documentation/devicetree/bindings/soc/microchip': No space left on device

▶ ▼ Discussions (3)

Title	Replies (including bot)	Last reply
[PATCH 1/1] mm: lock VMAs skipped by a failed queue_pages_range()	4 (4)	2023/09/19 21:09
[syzbot] [mm?] kernel BUG in vma_replace_policy	23 (26)	2023/09/19 00:34
[PATCH] mm: as the same logic with queue_pages_range	5 (5)	2023/09/14 05:53

▶ ▼ Last patch testing requests (7)


Created	Duration	User	Patch	Repo	Result
2023/09/14 04:56	24m	eadavis@sina.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git a47fc304d2b6	OK log
2023/09/14 02:06	36m	eadavis@sina.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git a47fc304d2b6	report log
2023/09/12 05:30	35m	willy@infradead.org	patch	upstream	OK log
2023/09/09 03:42	33m	hdanton@sina.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master	OK log
2023/09/06 04:16	22m	eadavis@sina.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git a47fc304d2b6	OK log
2023/09/06 02:58	6m	eadavis@sina.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git a47fc304d2b6	error
2023/09/06 02:47	24m	eadavis@sina.com	patch	https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git a47fc304d2b6	OK log

Sample crash report:

vma ffff88806ea68600 start 0000000020c2a000 end 0000000021000000 mm ffff888025458000
prot 25 anon_vma 0000000000000000 vm_ops 0000000000000000
pgoff 20c2a file 0000000000000000 private_data 0000000000000000
flags: 0x8100077(read|write|exec|mayread|maywrite|mayexec|account|softdirty)
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:733!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5036 Comm: syz-executor178 Not tainted 6.5.0-syzkaller-11812-g7733171926cc #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:vma_assert_write_locked include/linux/mm.h:733 [inline]
RIP: 0010:vma_assert_write_locked include/linux/mm.h:729 [inline]
RIP: 0010:vma_replace_policy+0x406/0x4e0 mm/mempolicy.c:783
Code: ff 48 89 ef e8 db 78 ff ff e9 83 fe ff ff e8 f1 7c ad ff 4c 89 e7 e8 d9 87 eb ff 0f 0b e8 e2 7c ad ff 48 89 df e8 2a 85 eb ff <0f> 0b e8 d3 7c ad ff 41 89 ec e9 58 fe ff ff 48 c7 c7 50 2d ce 8e
RSP: 0018:ffffc90003a6fc58 EFLAGS: 00010282
RAX: 000000000000011b RBX: ffff88806ea68600 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff816b5c72 RDI: 0000000000000005
RBP: ffff88806ea71000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000015
R13: 0000000000000016 R14: 0000000000000001 R15: 0000000021000000
FS:  0000555556197380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055982602f6f8 CR3: 000000006ead6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 mbind_range+0x37c/0x530 mm/mempolicy.c:855
 do_mbind+0x583/0xa00 mm/mempolicy.c:1345
 kernel_mbind+0x1d4/0x1f0 mm/mempolicy.c:1502
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f87f90d8369
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd6da77898 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed
RAX: ffffffffffffffda RBX: 00007ffd6da77a78 RCX: 00007f87f90d8369
RDX: 0000000000000004 RSI: 0000000000c00000 RDI: 0000000020400000
RBP: 00007f87f914b610 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd6da77a68 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vma_assert_write_locked include/linux/mm.h:733 [inline]
RIP: 0010:vma_assert_write_locked include/linux/mm.h:729 [inline]
RIP: 0010:vma_replace_policy+0x406/0x4e0 mm/mempolicy.c:783
Code: ff 48 89 ef e8 db 78 ff ff e9 83 fe ff ff e8 f1 7c ad ff 4c 89 e7 e8 d9 87 eb ff 0f 0b e8 e2 7c ad ff 48 89 df e8 2a 85 eb ff <0f> 0b e8 d3 7c ad ff 41 89 ec e9 58 fe ff ff 48 c7 c7 50 2d ce 8e
RSP: 0018:ffffc90003a6fc58 EFLAGS: 00010282
RAX: 000000000000011b RBX: ffff88806ea68600 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff816b5c72 RDI: 0000000000000005
RBP: ffff88806ea71000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000015
R13: 0000000000000016 R14: 0000000000000001 R15: 0000000021000000
FS:  0000555556197380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055982602f6f8 CR3: 000000006ead6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (6):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2023/09/06 06:24	upstream	7733171926cc	8bc9053e	.config	strace log	report	syz	C		[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	kernel BUG in vma_replace_policy
2023/09/02 01:17	linux-next	a47fc304d2b6	696ea0d2	.config	strace log	report	syz	C		[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	kernel BUG in vma_replace_policy
2023/09/14 23:13	upstream	9fdfb15a3dbf	0b6a67ac	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	kernel BUG in vma_replace_policy
2023/09/09 04:35	upstream	a48fa7efaf11	6654cf89	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	kernel BUG in vma_replace_policy
2023/09/03 08:47	upstream	92901222f83d	696ea0d2	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-gce	kernel BUG in vma_replace_policy
2023/09/02 00:54	linux-next	a47fc304d2b6	696ea0d2	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-linux-next-kasan-gce-root	kernel BUG in vma_replace_policy

* ~~Struck through~~ repros no longer work on HEAD.